mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-26 09:12:16 +00:00
ca4bba3992
# Which Problems Are Solved As part of moving the session API to the relational database, this PR adds the functionality to delete sessions through the session API v2 and the OIDC end_session endpoint. # How the Problems Are Solved - added `SessionDeleteCommand` in domain package - added possibility to pass the session token verifier to the domain package - use feature flag to switch API and OIDC usage from CQRS to relation table - added a `permissionCheck` condition to let permissions be checked directly in the repository / sql - part of it is still a placeholder until actual permission tables are done - added a `session_deleted` table to store (recently) deleted sessions to handle necessary checks / cases like delete my own session, which needs to be idempotent # Additional Changes Fixed `Matches` function of `existsCondition` (as missing an implementation) # Additional Context - closes #11037 --------- Co-authored-by: Stefan Benz <[email protected]>
72 lines
2.7 KiB
Go
72 lines
2.7 KiB
Go
package domain
|
|
|
|
import "context"
|
|
|
|
const (
|
|
InstanceReadPermission = "instance.read"
|
|
InstanceWritePermission = "instance.write"
|
|
DomainReadPermission = "domain.read"
|
|
DomainWritePermission = "domain.write"
|
|
OrganizationReadPermission = "organization.read"
|
|
OrganizationWritePermission = "organization.write"
|
|
SessionReadPermission = "session.read"
|
|
SessionWritePermission = "session.write"
|
|
SessionDeletePermission = "session.delete"
|
|
)
|
|
|
|
// PermissionRepository is the interface that manages and checks Zitadel permissions.
|
|
//
|
|
// TODO(muhlemmer): This just defines the checker methods, rest to be done later.
|
|
type PermissionRepository interface {
|
|
PermissionChecker
|
|
}
|
|
|
|
// PermissionChecker defines the methods needed to check permissions.
|
|
//
|
|
//go:generate mockgen -typed -package domainmock -destination ./mock/permission.mock.go . PermissionChecker
|
|
type PermissionChecker interface {
|
|
// Check if the authenticated user has the given permission on instance level.
|
|
CheckInstancePermission(ctx context.Context, permission string) error
|
|
|
|
// Check if the authenticated user has the given permission on the given organization.
|
|
// A permission may be inherited from the instance level.
|
|
CheckOrganizationPermission(ctx context.Context, permission, orgID string) error
|
|
|
|
// Check if the authenticated user has the given permission on the given project.
|
|
// A permission may be inherited from the instance or organization level.
|
|
CheckProjectPermission(ctx context.Context, permission, projectID string) error
|
|
|
|
// Check if the authenticated user has the given permission on the given project grant.
|
|
// A permission may be inherited from the instance or granted organization level.
|
|
CheckProjectGrantPermission(ctx context.Context, permission, projectGrantID string) error
|
|
|
|
// Check if the user in context has the given permission on the given session.
|
|
// A permission may be inherited from the instance or granted organization level.
|
|
CheckSessionPermission(ctx context.Context, permission, sessionID string) error
|
|
}
|
|
|
|
type noopPermissionChecker struct{}
|
|
|
|
// CheckSessionPermission implements [PermissionChecker].
|
|
func (n *noopPermissionChecker) CheckSessionPermission(ctx context.Context, permission string, sessionID string) error {
|
|
return nil
|
|
}
|
|
|
|
var _ PermissionChecker = (*noopPermissionChecker)(nil)
|
|
|
|
func (*noopPermissionChecker) CheckInstancePermission(context.Context, string) error {
|
|
return nil
|
|
}
|
|
|
|
func (*noopPermissionChecker) CheckOrganizationPermission(context.Context, string, string) error {
|
|
return nil
|
|
}
|
|
|
|
func (*noopPermissionChecker) CheckProjectPermission(context.Context, string, string) error {
|
|
return nil
|
|
}
|
|
|
|
func (*noopPermissionChecker) CheckProjectGrantPermission(context.Context, string, string) error {
|
|
return nil
|
|
}
|